Operation MiddleFloor: Disinformation campaign targets Moldova ahead of presidential elections and EU membership referendum

Check Point Research documents Operation MiddleFloor, an active, email-driven disinformation campaign by the Russian-speaking actor ‘Lying Pigeon’ targeting Moldovan government and education institutions ahead of elections and an EU-membership referendum. The campaign uses spoofed EU and Moldovan domains, falsified PDFs and forms that collect personal and environment data (exfiltrated to Telegram bots), and interconnected hosting and mail infrastructure; investigators link this activity to prior Europe-wide clusters and to distribution of infostealer malware. The report includes detailed TTPs and IOCs (domains, IPs, mail servers, and file hashes) to support detection and mitigation.